TIL that on windows, cmd.exe /c implements a CVE for you by default, by automagically interpreting any passed *command line* as a *filename with spaces*. You need to pass /s to turn off the free CVE. So cmd /c "ping http://evil.com/../../../../../../windows/calc.exe" pops calc.
-
-
Here are the MS docs on this behavior, which are almost incomprehensible:https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmd …
Show this threadThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.